New: All four List policy endpoints now accept filters. Every policy type filters by name, id, mode, user, userEmail, userGroup and deviceGroup, and each adds its own, such as control, application and logLevel. Repeat a parameter to pass several values.; Pre-login rules are now configurable through the API; the management console has always had them. Set authenticationState to unauthenticated and the rule applies to anonymous Extension users until they authenticate. It must be unscoped, allow or block, and target SaaS applications or groups.; Two new Access and Data login controls. socialLogin blocks consumer social logins (Google, Microsoft, Facebook, GitHub, X, LinkedIn, Apple), with googleAllowedDomains and mfaRequired. idpLogin allows or blocks SSO and SAML logins, globally or per provider domain.; New Customization control sidebar: turn the browser sidebar on or off and publish up to 12 managed shortcuts, each with a name, URL, optional icon and side-view option.; The access control accepts a new webpageFrame object that draws a colored frame with optional text around the page, to mark a regulated environment. Include it to enable the frame, omit it to disable.; The redirect access action is now configurable through the API. Set enforceRedirect.url, add autoRedirect to send the user on without a click, and use enforceRedirectDialogText for the transition page.; Access and Data logging adds dataSnippet and evidenceStorage for content-scanning snippets and scan evidence. Both need logLevel of on or enhanced and a data profile in dlpProfileId.; Applications now carry a classification: Sanctioned, Tolerated, Unsanctioned or Unclassified, and reads return the custom tags that tagIDs sets. Assign tags in the management console for now: it does not surface the IDs these fields expect. Non-web applications also accept an address.; New application type localdesktopcatalog for catalog-based local desktop applications, alongside the admin-defined localdesktopcustom. Both report their executables, so handle the new value if you switch on type.; New read-only IDP Application Sync endpoints. List your providers or fetch one by ID for its displayName, type (currently entraId), live status, and for Entra its tenantId and clientId.; Pending changes can now be filtered by entityTypes, repeatable for several, and by lastUpdatedBy (admin email or service account). lastUpdatedBy=me resolves to the calling identity.; Cloud storage now tells you why a call failed. Create returns 409 when a provider already exists, create and replace return 422 when the request cannot be applied, and delete returns 409 with PROVIDER_IN_USE.

Changed: The allowProtectedBetweenRuleApps upload action on File Protection is now writable, not read-only. It lets users upload Prisma-protected files downloaded from the same rule's applications, and still requires fileDownload.action of useInPrismaBrowserOnly.; durationMinutes now applies beyond admin approvals. On the login controls (formLogin, idpLogin, socialLogin, passkeyLogin) it is accepted for every mode except none and also sets how long a user's own bypass lasts, from 10 minutes to 90 days.; Publishing a draft now tells you which 409 you hit through error.code: CONFLICT when the draft has no changes, or PUBLISH_IN_PROGRESS when another publish or reset holds the lock, in which case nothing was published.; Much higher list limits. An application's URL list is no longer capped at 100: it is configurable per tenant up to 15,000 URLs, including the add and remove lists. AWS tenant restrictions take 35,000 account IDs and managedShortcuts 200 entries.; Smaller input changes. sessionRecording is now optional in an Access and Data rule's tracking object and defaults to false, protocolSchemes accepts a bare scheme such as zoom, and microsoftOutlook joins Open Links in External Apps.; Endpoint titles were rewritten to a consistent, action-first style, so Retrieve the Security Policy is now Get the Security policy. Paths, operations and payloads are unchanged, and the reference navigation is now 15 sections.

Read the full release notes

New: You can now set a rule or section's position when you create or update it, across all four policy types (Sign-In, Security, Access & Data, Customization). Place it at the top or bottom, or before or after an anchor, instead of making a separate positions call.; New Browser Security control remoteDebugging: allow or block remote debugging on Android and iOS devices to prevent data leaks and simplify troubleshooting.; New Browser Customization control prismaBrowserDesktopExtender: enable or disable Prisma Browser Local Extender (PABL). This capability is gated and being rolled out gradually, so it may not be available on your tenant yet.; New endpoint to preview everything pending in your draft before you publish. Each item reports the entity, its type, what changed (created, updated, or deleted), and who changed it.; New includeTotalCount query parameter on list endpoints. The total count is already returned on the first page by default, so use this to skip it for speed or request it on later pages.; The genAIPrompt control now supports custom block-dialog text via customDialogText.; Access & Data logging can now include the text of prompts users submit to GenAI applications, via shouldLogGenAiPrompt. Available when logLevel is on or enhanced, and requires the genAIPrompt control.; Web-page watermarks expose new display options: showCompanyLogo, showTextDetails (email, timestamp), and showQrCode.

Read the full release notes

New: Initial release of the Policy API. You can now manage all your policy types via the API. This is a beta release: based on feedback, we may introduce breaking changes until it reaches GA.; New cloud-storage integration API: rotate a provider's credentials programmatically. Credentials are replaced with zero downtime, so there is no interruption for your users.

Read the full release notes